Detections
Analytics

GEN002420 - Removable media, remote file systems and any file system not containing approved setuid files must be mounted with nosuid.

Information

The nosuid mount option causes the system to not execute setuid files with owner privileges. This option must be used for mounting any file system not containing approved setuid files. Executing setuid files from untrusted file systems, or file systems not containing approved setuid files, increases the opportunity for unprivileged users to attain unauthorized administrative access.

Solution

Edit /etc/filesystems and add the options = nosuid to the stanza of file system mounted from removable media or network shares, and any file system not containing approved setuid or setgid files.
OR
Add the nosuid option with the chfs command.
# chfs -a options=nosuid <filesystem>

See Also

http://iasecontent.disa.mil/stigs/zip/U_STIG_Library_2015_07.zip

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(10), CAT|II, CCI|CCI-000225, Rule-ID|SV-38746r1_rule, STIG-ID|GEN002420, Vuln-ID|V-805

Plugin: Unix

Control ID: 09992ec3ae92417c77255c0ad171365e178823db48fdb630e347d3be0ede6c51